CVE-2025-25973 Details
Description
A stored Cross Site Scripting vulnerability in the "related recommendations" feature in Ppress v.0.0.9 allows a remote attacker to execute arbitrary code via a crafted script to the article.title, article.category, and article.tags parameters.
A stored cross-site scripting vulnerability has been identified in PPress version 0.0.9, specifically within the 'related recommendations' feature. This vulnerability allows remote attackers to execute arbitrary code by injecting malicious scripts into the article.title, article.category, and article.tags parameters. The injected scripts are stored and executed when users interact with the affected recommendations, potentially leading to arbitrary code execution in the user's browser.
To address this vulnerability, it is recommended to validate and sanitize input for the title, category, and tags fields. Implement output encoding to replace unsafe rendering practices with context-aware escaping. Additionally, consider applying a Content Security Policy to block inline scripts.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 20, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/coleak2021/512acaa12ba0987499d560967acff1d1 | [email protected] | MitigationPatchThird Party Advisory |
| https://github.com/yandaozi/PPress/issues/3 | [email protected] | ExploitIssue Tracking |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| yandaozi ppress | 0.0.9 beta |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2025 | Initial Analysis | [email protected] |
| Feb 20, 2025 | CVE Modified | CISA-ADP |
| Feb 20, 2025 | New CVE Received | [email protected] |